CVE-2020-15131: slp-validate - False-positive validity for NFT1 genesis transactions
Summary
CVE-2020-15131: False-positive validity for NFT1 genesis transactions. Affects slp-validate versions < 1.2.2. Fixed in 1.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm package 'slp-validate' is a library used for validating Simple Ledger Protocol (SLP) transactions. It provides functionality to verify the validity of SLP tokens, including Non-Fungible Token Type 1 (NFT1) tokens. NFT1 tokens are a specific type of SLP token that represent unique assets. The 'slp-validate' package is vulnerable to a false-positive validation issue for NFT1 Child Genesis transactions. This vulnerability allows a poorly implemented SLP wallet or an opportunistic attacker to create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type, which is required by the NFT1 specification.
Vulnerability Detail
The vulnerability in the 'slp-validate' package allows for false-positive validation outcomes for NFT1 Child Genesis transactions. This means that a malicious actor or a poorly implemented SLP wallet can create a seemingly valid NFT1 child token without following the correct protocol. The NFT1 specification requires burning a certain amount of the NFT1 Group token type to create a valid NFT1 child token. By bypassing this requirement, an attacker can create counterfeit NFT1 child tokens, leading to potential confusion and misuse of the token system.
How To Fix
Latest published version: 1.2.3 as of 23 Oct 2026
npm install slp-validate@1.2.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.2
This is the first release that contains the fix.
npm install slp-validate@1.2.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
The recommended workaround for this vulnerability is to upgrade to version 1.2.2 of the 'slp-validate' package. This can be done by updating the package in your project's package.json file and running the package manager's update command. For example, if you are using npm as your package manager, you can run 'npm install slp-validate@1.2.2' to install the patched version.
Conclusion
The 'slp-validate' package prior to version 1.2.2 is vulnerable to false-positive validation outcomes for NFT1 Child Genesis transactions. This can lead to the creation of counterfeit NFT1 child tokens, potentially causing confusion and misuse of the token system. To mitigate this vulnerability, it is recommended to upgrade to version 1.2.2 of the package. For further support and assistance, you can contact DevNack.com.
See every vulnerability recorded for slp-validate →
FAQ
The vulnerability allows for the creation of counterfeit NFT1 child tokens, which can lead to confusion and misuse of the token system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply input your package-lock.json file and the playground will analyze it for any open-source vulnerabilities, including this one.
There are no known exploits of this vulnerability at the moment. However, it is important to update to the patched version to prevent any potential misuse of the token system.
Yes, you can refer to the SLP NFT1 spec (https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements) for more information on the NFT1 protocol requirements and specifications.
If you have any questions or need assistance in fixing this vulnerability, you can reach out to info@devnack.com for further support.
References
Related vulnerabilities
Recent vulnerabilities recorded for slp-validate.
